[Samba] [SECURITY] Samba 3.0.1 - 3.0.22: memory exhaustion DoSagainst smbd

[Gautier, B (Bob)]

> -----Original Message-----
> 
> ==========================================================
> ==
> == Subject:     Memory exhaustion DoS against smbd
> == CVE ID#:     CAN-2006-1059
> ==
> == Versions:    Samba Samba 3.0.1 - 3.0.22 (inclusive)
> ==
> == Summary:     smbd may allow internal structures
> ==              maintaining state for share connections
> ==              to grow unbounded.
> ==
> ==========================================================
> 
> 
> ===========
> Description
> ===========
> 
> The smbd daemon maintains internal data structures used track 
> active connections to file and printer shares.  In certain 
> circumstances an attacker may be able to continually increase 
> the memory usage of an smbd process by issuing a large number 
> of share connection requests.  This defect affects all Samba 
> configurations.

While we wait for this patch to get backported into 3.0.10 as a RHEL4
update, will setting the 'max connections' parameter on all shares work
around this problem?

Bob G
_____________________________________________________________

This email (including any attachments to it) is confidential, legally privileged, subject to copyright and is sent for the personal attention of the intended recipient only. If you have received this email in error, please advise us immediately and delete it. You are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Although we have taken reasonable precautions to ensure no viruses are present in this email, we cannot accept responsibility for any loss or damage arising from the viruses in this email or attachments. We exclude any liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided in this email or its attachments, unless that information is subsequently confirmed in writing. If this email contains an offer, that should be considered as an invitation to treat.
_____________________________________________________________